<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>SAST scan report</title>
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre.min.css">
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre-exp.min.css">
  <link rel="stylesheet" href="https://unpkg.com/spectre.css/dist/spectre-icons.min.css">
  <style>
    .divider[data-content] {
      margin: 1.6rem 0;
    }
  </style>
</head>
<body>







<div class="container grid-xl" style="min-height: 90vh;">
  <header class="navbar" style="height: 4rem;">
  <section class="navbar-section">
    <a href="https://www.shiftleft.io" class="navbar-brand"><img width="60px" src="https://avatars3.githubusercontent.com/u/58593322?s=240&v=4" /></a>
    <a href="https://github.com/ShiftLeftSecurity/sast-scan" class="btn ml-1">sast-scan</a>
    <a href="https://github.com/ShiftLeftSecurity/dep-scan" class="btn ml-1">dep-scan</a>
  </section>
  </header>
  <div class="columns">
    <div class="column col-12">
      <div class="hero hero-sm bg-dark">
        <div class="hero-body">
          <h1>SAST scan status <span class="tooltip tooltip-top" data-tooltip="Issues were found in this run"><i class="text-error icon icon-4x icon-cross"></i></span></h1>
          <p>Report from the scan performed on <span class="text-dark chip"><i class="icon icon-time"> </i>&nbsp; 2020-03-15 at 21:48:07</span> for <a class="btn" href="https://github.com/ShiftLeftSecurity/WebGoat">https://github.com/ShiftLeftSecurity/WebGoat</a></p>
        </div>
      </div>
    </div>
  </div>
  <div class="columns col-gapless">
    <div class="column col-6">
      <div class="card">
        <div class="card-header">
          <div class="card-title h4">Repository Details</div>
          <div class="card-subtitle text-gray">https://github.com/ShiftLeftSecurity/WebGoat</div>
        </div>
        <div class="card-body">
          <div class=""><strong>Branch</strong> <span>develop</span></div>
          <div class=""><strong>Commit</strong> <span>2edd84b77e39ae9e20dba319f64c6c9c42f4045e</span></div>
        </div>
      </div>
    </div>
    <div class="column col-6">
      <div class="card">
        <div class="card-header">
          <div class="card-title h4">Invocation Details</div>
          <div class="card-subtitle text-gray">Java security audit</div>
        </div>
        <div class="card-body">
          <div class=""><strong>Run Id</strong> <span>85bd11a5-4d71-4bc3-ac78-b47d03762fd2</span></div>
          <div class=""><strong>Directory</strong> <span>file:///Users/guest/work/WebGoat</span></div>
        </div>
      </div>
    </div>
  </div>
  <div class="divider text-center" data-content="Summary"></div>
  <section id="#summary"></section>
  <details class="accordion" open>
    <summary class="accordion-header">
    <i class="icon icon-arrow-right mr-1"></i>
    Executive Summary
  </summary>
    <div class="accordion-body columns col-gapless">
    <div class="column col-12">
        <p>This report was generated by Scan from the SAST scan invocation on 2020-03-15 at 21:48:07. The scan used the open source tool <span class="text-bold"> Java security audit</span> to scan the source code repository <a href="https://github.com/ShiftLeftSecurity/WebGoat" rel="noopener" target="_blank">https://github.com/ShiftLeftSecurity/WebGoat</a>.
        </p>

        <p>
        Below is a summary of the issues identified:
        </p>
        <table class="table">
          <thead>
          <tr>
            <th>Severity</th>
            <th>Count</th>
          </tr>
          </thead>
          <tbody>
          <tr>
            <td><span class="bg-error chip">CRITICAL</span></td>
            <td>44</td>
          </tr><tr>
            <td><span class="bg-warning chip">HIGH</span></td>
            <td>40</td>
          </tr><tr>
            <td><span class="bg-dark chip">MEDIUM</span></td>
            <td>0</td>
          </tr><tr>
            <td><span class="bg-success chip">LOW</span></td>
            <td>0</td>
          </tr><tr>
            <td><span class="bg-total chip">TOTAL</span></td>
            <td>84</td>
          </tr>
          </tbody>
        </table>


      <p>&nbsp;</p>
      <p><i class="icon icon-flag icon-2x text-warning"></i>&nbsp; ShiftLeft recommends immediate remediation of the key issues identified before using this application in a live environment.</p>

    </div>
  </div>
  </details>

  <div class="divider text-center" data-content="Requires attention"></div>
  <section id="#key_issues"></section>
  <details class="accordion" open>
    <summary class="accordion-header">
    <i class="icon icon-arrow-right mr-1"></i>
      Key Issues <span class="text-bold">4 / 44</span>
  </summary>
    <div class="accordion-body columns col-gapless">

    <div class="column col-6">
      <div class="panel">
        <div class="panel-body" style="padding: .8rem;">
          <div class="tile">
            <div class="tile-icon">
              <figure class="bg-error avatar avatar-lg mr-2" data-initial="1"></figure>
            </div>
            <div class="tile-content">
              <p class="tile-title text-bold">CWE-78</p>
              <span><a target="_blank" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-deserialization/src/main/java/org/dummy/insecure/framework/VulnerableTaskHolder.java">VulnerableTaskHolder.java</a></span>
              <p class="tile-subtitle"><div class="">This usage of java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[lines 19-68] <br/><span class='bg-dark chip'>Class</span> org.dummy.insecure.framework.VulnerableTaskHolder <br/><span class='bg-dark chip'>Method</span> org.dummy.insecure.framework.VulnerableTaskHolder.readObject(ObjectInputStream) <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[<span class='bg-dark chip'>line</span>56] <br/>Sink method java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process; <br/>Sink parameter 0 <br/>Unknown source org/dummy/insecure/framework/VulnerableTaskHolder.taskAction <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[<span class='bg-dark chip'>line</span>56].</div></p>



<pre class="code"><code><a target="_blank" class="btn" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-deserialization/src/main/java/org/dummy/insecure/framework/VulnerableTaskHolder.java#L55"><i class="icon icon-location"></i> 55:</a> try {<br/>                    Process p = Runtime.getRuntime().exec(taskAction);<br/>
</code>
</pre>
            </div>
          </div>
        </div>
      </div>
    </div>
    <div class="column col-6">
      <div class="panel">
        <div class="panel-body" style="padding: .8rem;">
          <div class="tile">
            <div class="tile-icon">
              <figure class="bg-error avatar avatar-lg mr-2" data-initial="2"></figure>
            </div>
            <div class="tile-content">
              <p class="tile-title text-bold">CWE-79</p>
              <span><a target="_blank" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/AjaxAuthenticationEntryPoint.java">AjaxAuthenticationEntryPoint.java</a></span>
              <p class="tile-subtitle"><div class="">This use of javax/servlet/http/HttpServletResponse.sendError(ILjava/lang/String;)V could be vulnerable to XSS in the Servlet <br/><span class='bg-dark chip'>File</span>AjaxAuthenticationEntryPoint.java:[lines 48-57] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.AjaxAuthenticationEntryPoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.AjaxAuthenticationEntryPoint.commence(HttpServletRequest, HttpServletResponse, AuthenticationException) <br/><span class='bg-dark chip'>File</span>AjaxAuthenticationEntryPoint.java:[<span class='bg-dark chip'>line</span>53] <br/>Sink method javax/servlet/http/HttpServletResponse.sendError(ILjava/lang/String;)V <br/>Sink parameter 0 <br/>Unknown source org/springframework/security/core/AuthenticationException.getMessage()Ljava/lang/String;.</div></p>



<pre class="code"><code><a target="_blank" class="btn" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/AjaxAuthenticationEntryPoint.java#L52"><i class="icon icon-location"></i> 52:</a> if (request.getHeader("x-requested-with") != null) {<br/>                    response.sendError(401, authException.getMessage());<br/>
</code>
</pre>
            </div>
          </div>
        </div>
      </div>
    </div>
    <div class="column col-6">
      <div class="panel">
        <div class="panel-body" style="padding: .8rem;">
          <div class="tile">
            <div class="tile-icon">
              <figure class="bg-error avatar avatar-lg mr-2" data-initial="3"></figure>
            </div>
            <div class="tile-content">
              <p class="tile-title text-bold">CWE-259</p>
              <span><a target="_blank" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/CryptoTest.java">CryptoTest.java</a></span>
              <p class="tile-subtitle"><div class="">Hard coded password found <br/><span class='bg-dark chip'>File</span>CryptoTest.java:[lines 22-132] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.CryptoTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.CryptoTest.checkAssignment3() <br/><span class='bg-dark chip'>File</span>CryptoTest.java:[<span class='bg-dark chip'>line</span>72] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</div></p>



<pre class="code"><code><a target="_blank" class="btn" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/CryptoTest.java#L71"><i class="icon icon-location"></i> 71:</a> params.clear();<br/>        		params.put("answer_pwd1", answer_1);<br/>
</code>
</pre>
            </div>
          </div>
        </div>
      </div>
    </div>
    <div class="column col-6">
      <div class="panel">
        <div class="panel-body" style="padding: .8rem;">
          <div class="tile">
            <div class="tile-icon">
              <figure class="bg-error avatar avatar-lg mr-2" data-initial="4"></figure>
            </div>
            <div class="tile-content">
              <p class="tile-title text-bold">CWE-352</p>
              <span><a target="_blank" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java">HammerHead.java</a></span>
              <p class="tile-subtitle"><div class="">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>HammerHead.java:[lines 52-59] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.HammerHead <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.HammerHead.attack(Authentication, HttpServletRequest, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>HammerHead.java:[<span class='bg-dark chip'>line</span>59].</div></p>



<pre class="code"><code><a target="_blank" class="btn" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java#L58"><i class="icon icon-location"></i> 58:</a> public ModelAndView attack(Authentication authentication, HttpServletRequest request, HttpServletResponse response) {<br/>                return new ModelAndView("redirect:" + "start.mvc" + course.getFirstLesson().getLink());<br/>
</code>
</pre>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>
  </details>

  <div class="divider text-center" data-content="All"></div>
  <section id="#all_issues"></section>
  <div class="columns col-gapless">
    <div class="column col-12">
      <h3><i class="icon icon-link"></i> All Issues <span class="text-bold">(84)</span></h3>
    </div>
    <div class="column col-12">
      <div class="filter">
        <input type="radio" id="tag-0" class="filter-tag" name="filter-radio" hidden checked>
        <input type="radio" id="tag-1" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-2" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-3" class="filter-tag" name="filter-radio" hidden>
        <input type="radio" id="tag-4" class="filter-tag" name="filter-radio" hidden>

        <div class="filter-nav">
          <label class="chip" for="tag-0">All (84)</label>
          <label class="chip" for="tag-1">Critical (44)</label>
          <label class="chip" for="tag-2">High (40)</label>
          <label class="chip" for="tag-3">Medium (0)</label>
          <label class="chip" for="tag-4">Low (0)</label>
        </div>
        <div class="filter-body">
          <table class="table">
            <thead>
            <tr>
              <th>Rule</th>
              <th>Severity</th>
              <th>Source location</th>
              <th>Message</th>
            </tr>
            </thead>
            <tbody>




          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java#L58"><i class="icon icon-link"></i> HammerHead.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>HammerHead.java:[lines 52-59] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.HammerHead <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.HammerHead.attack(Authentication, HttpServletRequest, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>HammerHead.java:[<span class='bg-dark chip'>line</span>59].</span>
<pre class="code" style="max-width: 40%;"><code>public ModelAndView attack(Authentication authentication, HttpServletRequest request, HttpServletResponse response) {<br/>        return new ModelAndView("redirect:" + "start.mvc" + course.getFirstLesson().getLink());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/WebSecurityConfig.java#L71"><i class="icon icon-link"></i> WebSecurityConfig.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Disabling Spring Security's CSRF protection is unsafe for standard web applications <br/><span class='bg-dark chip'>File</span>WebSecurityConfig.java:[lines 55-98] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.WebSecurityConfig <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.WebSecurityConfig.configure(HttpSecurity) <br/><span class='bg-dark chip'>File</span>WebSecurityConfig.java:[<span class='bg-dark chip'>line</span>72].</span>
<pre class="code" style="max-width: 40%;"><code>.logout().deleteCookies("JSESSIONID").invalidateHttpSession(true);<br/>        security.and().csrf().disable();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge5/Assignment5.java#L58"><i class="icon icon-link"></i> Assignment5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Connection.prepareStatement(Ljava/lang/String;)Ljava/sql/PreparedStatement; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>Assignment5.java:[lines 45-67] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.challenges.challenge5.Assignment5 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.challenges.challenge5.Assignment5.login(String, String) <br/><span class='bg-dark chip'>File</span>Assignment5.java:[<span class='bg-dark chip'>line</span>59] <br/>Sink method java/sql/Connection.prepareStatement(Ljava/lang/String;)Ljava/sql/PreparedStatement; <br/>Sink parameter 0 <br/>Tainted source org/owasp/webgoat/challenges/challenge5/Assignment5.login(Ljava/lang/String;Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Tainted source org/owasp/webgoat/challenges/challenge5/Assignment5.login(Ljava/lang/String;Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 1 <br/><span class='bg-dark chip'>File</span>Assignment5.java:[<span class='bg-dark chip'>line</span>59].</span>
<pre class="code" style="max-width: 40%;"><code>try (var connection = dataSource.getConnection()) {<br/>            PreparedStatement statement = connection.prepareStatement("select password from challenge_users where userid = '" + username_login + "' and password = '" + password_login + "'");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge5/Assignment5.java#L58"><i class="icon icon-link"></i> Assignment5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">A prepared statement is generated from a nonconstant String in org.owasp.webgoat.challenges.challenge5.Assignment5.login(String, String)  <br/><span class='bg-dark chip'>File</span>Assignment5.java:[lines 45-67] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.challenges.challenge5.Assignment5 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.challenges.challenge5.Assignment5.login(String, String) <br/><span class='bg-dark chip'>File</span>Assignment5.java:[<span class='bg-dark chip'>line</span>59].</span>
<pre class="code" style="max-width: 40%;"><code>try (var connection = dataSource.getConnection()) {<br/>            PreparedStatement statement = connection.prepareStatement("select password from challenge_users where userid = '" + username_login + "' and password = '" + password_login + "'");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/MD5.java#L54"><i class="icon icon-link"></i> MD5.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>MD5.java:[lines 38-688] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.challenges.challenge7.MD5 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.challenges.challenge7.MD5.main(String[]) <br/><span class='bg-dark chip'>File</span>MD5.java:[<span class='bg-dark chip'>line</span>55] <br/>Sink method java/io/File.<init>(Ljava/lang/String;)V <br/>Sink parameter 0 <br/>Tainted source org/owasp/webgoat/challenges/challenge7/MD5.main([Ljava/lang/String;)V parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>                    System.out.println(MD5.getHashString(new File(element)) + " " + element);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java#L77"><i class="icon icon-link"></i> StartLesson.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>StartLesson.java:[lines 55-90] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.controller.StartLesson <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.controller.StartLesson.lessonPage(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>StartLesson.java:[lines 78-90].</span>
<pre class="code" style="max-width: 40%;"><code>// I will set here the thymeleaf fragment location based on the resource requested.<br/>        ModelAndView model = new ModelAndView();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/controller/StartLesson.java#L66"><i class="icon icon-link"></i> StartLesson.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>StartLesson.java:[lines 55-90] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.controller.StartLesson <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.controller.StartLesson.start() <br/><span class='bg-dark chip'>File</span>StartLesson.java:[lines 67-72].</span>
<pre class="code" style="max-width: 40%;"><code>public ModelAndView start() {<br/>        ModelAndView model = new ModelAndView();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L51"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.getMd5(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 52-65].</span>
<pre class="code" style="max-width: 40%;"><code><br/>		String md5Hash = (String) request.getSession().getAttribute("md5Hash");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L71"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.getSha256(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 72-79].</span>
<pre class="code" style="max-width: 40%;"><code><br/>		String sha256 = (String) request.getSession().getAttribute("sha256");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-328
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L56"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API MD5 (MDX) is not a recommended cryptographic hash function <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.getMd5(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>57] <br/>Value MD5.</span>
<pre class="code" style="max-width: 40%;"><code><br/>		    MessageDigest md = MessageDigest.getInstance("MD5");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/SigningAssignment.java#L53"><i class="icon icon-link"></i> SigningAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>SigningAssignment.java:[lines 48-75] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.SigningAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.SigningAssignment.getPrivateKey(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>SigningAssignment.java:[lines 54-61].</span>
<pre class="code" style="max-width: 40%;"><code><br/>		String privateKey = (String) request.getSession().getAttribute("privateKeyString");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-502
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/deserialization/InsecureDeserializationTask.java#L55"><i class="icon icon-link"></i> InsecureDeserializationTask.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Object deserialization is used in org.owasp.webgoat.deserialization.InsecureDeserializationTask.completed(String) <br/><span class='bg-dark chip'>File</span>InsecureDeserializationTask.java:[lines 42-79] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.deserialization.InsecureDeserializationTask <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.deserialization.InsecureDeserializationTask.completed(String) <br/><span class='bg-dark chip'>File</span>InsecureDeserializationTask.java:[<span class='bg-dark chip'>line</span>56].</span>
<pre class="code" style="max-width: 40%;"><code>before = System.currentTimeMillis();<br/>            Object o = ois.readObject();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-502
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-deserialization/src/main/java/org/owasp/webgoat/deserialization/SerializationHelper.java#L20"><i class="icon icon-link"></i> SerializationHelper.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Object deserialization is used in org.owasp.webgoat.deserialization.SerializationHelper.fromString(String) <br/><span class='bg-dark chip'>File</span>SerializationHelper.java:[lines 12-51] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.deserialization.SerializationHelper <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.deserialization.SerializationHelper.fromString(String) <br/><span class='bg-dark chip'>File</span>SerializationHelper.java:[<span class='bg-dark chip'>line</span>21].</span>
<pre class="code" style="max-width: 40%;"><code>new ByteArrayInputStream(data));<br/>        Object o = ois.readObject();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/http-proxies/src/main/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequest.java#L38"><i class="icon icon-link"></i> HttpBasicsInterceptRequest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>HttpBasicsInterceptRequest.java:[lines 33-45] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.http_proxies.HttpBasicsInterceptRequest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.http_proxies.HttpBasicsInterceptRequest.completed(Boolean, String, HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HttpBasicsInterceptRequest.java:[lines 39-45].</span>
<pre class="code" style="max-width: 40%;"><code>@RequestParam(value = "changeMe", required = false) String paramValue, HttpServletRequest request) {<br/>        if (HttpMethod.POST.matches(request.getMethod())) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpoint.java#L57"><i class="icon icon-link"></i> JWTSecretKeyEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>JWTSecretKeyEndpoint.java:[lines 48-89] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTSecretKeyEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTSecretKeyEndpoint.getSecretToken() <br/><span class='bg-dark chip'>File</span>JWTSecretKeyEndpoint.java:[<span class='bg-dark chip'>line</span>58].</span>
<pre class="code" style="max-width: 40%;"><code>public String getSecretToken() {<br/>        return Jwts.builder()<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java#L70"><i class="icon icon-link"></i> LabelDebugService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LabelDebugService.java:[lines 55-99] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LabelDebugService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LabelDebugService.checkDebuggingStatus() <br/><span class='bg-dark chip'>File</span>LabelDebugService.java:[<span class='bg-dark chip'>line</span>71].</span>
<pre class="code" style="max-width: 40%;"><code>ResponseEntity<Map<String, Object>> checkDebuggingStatus() {<br/>        log.debug("Checking label debugging, it is {}", labelDebugger.isEnabled());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LabelDebugService.java#L84"><i class="icon icon-link"></i> LabelDebugService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LabelDebugService.java:[lines 55-99] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LabelDebugService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LabelDebugService.setDebuggingStatus(Boolean) <br/><span class='bg-dark chip'>File</span>LabelDebugService.java:[<span class='bg-dark chip'>line</span>85].</span>
<pre class="code" style="max-width: 40%;"><code>ResponseEntity<Map<String, Object>> setDebuggingStatus(@RequestParam("enabled") Boolean enabled) throws Exception {<br/>        log.debug("Setting label debugging to {} ", labelDebugger.isEnabled());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonInfoService.java#L32"><i class="icon icon-link"></i> LessonInfoService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LessonInfoService.java:[lines 22-33] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LessonInfoService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LessonInfoService.getLessonInfo() <br/><span class='bg-dark chip'>File</span>LessonInfoService.java:[<span class='bg-dark chip'>line</span>33].</span>
<pre class="code" style="max-width: 40%;"><code>Lesson lesson = webSession.getCurrentLesson();<br/>        return new LessonInfoModel(lesson.getTitle(), false, false, false);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonMenuService.java#L82"><i class="icon icon-link"></i> LessonMenuService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LessonMenuService.java:[lines 64-109] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LessonMenuService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LessonMenuService.showLeftNav() <br/><span class='bg-dark chip'>File</span>LessonMenuService.java:[<span class='bg-dark chip'>line</span>83].</span>
<pre class="code" style="max-width: 40%;"><code>LessonMenuItem categoryItem = new LessonMenuItem();<br/>            categoryItem.setName(category.getName());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonProgressService.java#L42"><i class="icon icon-link"></i> LessonProgressService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LessonProgressService.java:[lines 29-81] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LessonProgressService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LessonProgressService.lessonOverview() <br/><span class='bg-dark chip'>File</span>LessonProgressService.java:[lines 43-50].</span>
<pre class="code" style="max-width: 40%;"><code>public List<LessonOverview> lessonOverview() {<br/>        UserTracker userTracker = userTrackerRepository.findByUser(webSession.getUserName());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/LessonTitleService.java#L33"><i class="icon icon-link"></i> LessonTitleService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LessonTitleService.java:[lines 21-35] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.LessonTitleService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.LessonTitleService.showPlan() <br/><span class='bg-dark chip'>File</span>LessonTitleService.java:[lines 34-35].</span>
<pre class="code" style="max-width: 40%;"><code>String showPlan() {<br/>        Lesson lesson = webSession.getCurrentLesson();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/RestartLessonService.java#L51"><i class="icon icon-link"></i> RestartLessonService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>RestartLessonService.java:[lines 44-52] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.RestartLessonService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.RestartLessonService.restartLesson() <br/><span class='bg-dark chip'>File</span>RestartLessonService.java:[<span class='bg-dark chip'>line</span>52].</span>
<pre class="code" style="max-width: 40%;"><code>Lesson al = webSession.getCurrentLesson();<br/>        log.debug("Restarting lesson: " + al);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/service/SessionService.java#L39"><i class="icon icon-link"></i> SessionService.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>SessionService.java:[lines 28-60] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.service.SessionService <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.service.SessionService.showSession(HttpServletRequest, HttpSession) <br/><span class='bg-dark chip'>File</span>SessionService.java:[lines 40-60].</span>
<pre class="code" style="max-width: 40%;"><code>String showSession(HttpServletRequest request, HttpSession session) {<br/>        StringBuilder sb = new StringBuilder();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.java#L64"><i class="icon icon-link"></i> SqlInjectionChallenge.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionChallenge.java:[lines 49-95] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge.registerNewUser(String, String, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionChallenge.java:[<span class='bg-dark chip'>line</span>65] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Tainted source org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.registerNewUser(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 2 <br/><span class='bg-dark chip'>File</span>SqlInjectionChallenge.java:[<span class='bg-dark chip'>line</span>63].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement();<br/>                ResultSet resultSet = statement.executeQuery(checkUserQuery);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.java#L64"><i class="icon icon-link"></i> SqlInjectionChallenge.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge.registerNewUser(String, String, String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionChallenge.java:[lines 49-95] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge.registerNewUser(String, String, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionChallenge.java:[<span class='bg-dark chip'>line</span>65].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement();<br/>                ResultSet resultSet = statement.executeQuery(checkUserQuery);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6a.java#L66"><i class="icon icon-link"></i> SqlInjectionLesson6a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[lines 45-96] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionLesson6a <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionLesson6a.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[<span class='bg-dark chip'>line</span>67] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6a.injectableQuery(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[<span class='bg-dark chip'>line</span>52] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[<span class='bg-dark chip'>line</span>60].</span>
<pre class="code" style="max-width: 40%;"><code>ResultSet.CONCUR_READ_ONLY)) {<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6a.java#L66"><i class="icon icon-link"></i> SqlInjectionLesson6a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.advanced.SqlInjectionLesson6a.injectableQuery(String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[lines 45-96] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionLesson6a <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.advanced.SqlInjectionLesson6a.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson6a.java:[<span class='bg-dark chip'>line</span>67].</span>
<pre class="code" style="max-width: 40%;"><code>ResultSet.CONCUR_READ_ONLY)) {<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java#L62"><i class="icon icon-link"></i> SqlInjectionLesson10.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson10.java:[lines 46-101] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson10 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson10.injectableQueryAvailability(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson10.java:[<span class='bg-dark chip'>line</span>63] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.injectableQueryAvailability(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson10.java:[<span class='bg-dark chip'>line</span>53] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson10.java:[<span class='bg-dark chip'>line</span>58].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java#L61"><i class="icon icon-link"></i> SqlInjectionLesson2.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson2.java:[lines 49-75] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson2 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson2.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson2.java:[<span class='bg-dark chip'>line</span>62] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.injectableQuery(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson2.java:[<span class='bg-dark chip'>line</span>56].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement(TYPE_SCROLL_INSENSITIVE, CONCUR_READ_ONLY);<br/>            ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java#L64"><i class="icon icon-link"></i> SqlInjectionLesson3.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeUpdate(Ljava/lang/String;)I can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson3.java:[lines 50-82] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson3 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson3.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson3.java:[<span class='bg-dark chip'>line</span>65] <br/>Sink method java/sql/Statement.executeUpdate(Ljava/lang/String;)I <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.injectableQuery(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson3.java:[<span class='bg-dark chip'>line</span>57].</span>
<pre class="code" style="max-width: 40%;"><code>CONCUR_READ_ONLY);<br/>                statement.executeUpdate(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson4.java#L58"><i class="icon icon-link"></i> SqlInjectionLesson4.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeUpdate(Ljava/lang/String;)I can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson4.java:[lines 46-74] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson4 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson4.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson4.java:[<span class='bg-dark chip'>line</span>59] <br/>Sink method java/sql/Statement.executeUpdate(Ljava/lang/String;)I <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson4.injectableQuery(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson4.java:[<span class='bg-dark chip'>line</span>53].</span>
<pre class="code" style="max-width: 40%;"><code>try (Statement statement = connection.createStatement(TYPE_SCROLL_INSENSITIVE, CONCUR_READ_ONLY)) {<br/>                statement.executeUpdate(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5a.java#L61"><i class="icon icon-link"></i> SqlInjectionLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[lines 47-118] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5a <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5a.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[<span class='bg-dark chip'>line</span>62] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5a.injectableQuery(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[<span class='bg-dark chip'>line</span>54] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[<span class='bg-dark chip'>line</span>60].</span>
<pre class="code" style="max-width: 40%;"><code>try (Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE)) {<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5a.java#L61"><i class="icon icon-link"></i> SqlInjectionLesson5a.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5a.injectableQuery(String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[lines 47-118] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5a <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5a.injectableQuery(String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5a.java:[<span class='bg-dark chip'>line</span>62].</span>
<pre class="code" style="max-width: 40%;"><code>try (Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE)) {<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java#L57"><i class="icon icon-link"></i> SqlInjectionLesson5b.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Connection.prepareStatement(Ljava/lang/String;II)Ljava/sql/PreparedStatement; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5b.java:[lines 45-95] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5b <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson5b.injectableQuery(String, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5b.java:[<span class='bg-dark chip'>line</span>58] <br/>Sink method java/sql/Connection.prepareStatement(Ljava/lang/String;II)Ljava/sql/PreparedStatement; <br/>Sink parameter 2 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.injectableQuery(Ljava/lang/String;Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5b.java:[<span class='bg-dark chip'>line</span>52] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson5b.java:[<span class='bg-dark chip'>line</span>56].</span>
<pre class="code" style="max-width: 40%;"><code>try (Connection connection = dataSource.getConnection()) {<br/>            PreparedStatement query = connection.prepareStatement(queryString, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java#L136"><i class="icon icon-link"></i> SqlInjectionLesson8.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeUpdate(Ljava/lang/String;)I can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[lines 47-141] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8.log(Connection, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>137] <br/>Sink method java/sql/Statement.executeUpdate(Ljava/lang/String;)I <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.log(Ljava/sql/Connection;Ljava/lang/String;)V parameter 0 <br/>Unknown source java/text/SimpleDateFormat.format(Ljava/util/Date;)Ljava/lang/String; <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>54] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>59] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>64] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>128] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>133] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson9.java:[<span class='bg-dark chip'>line</span>56] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson9.java:[<span class='bg-dark chip'>line</span>61] <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson9.java:[<span class='bg-dark chip'>line</span>65].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement(TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE);<br/>            statement.executeUpdate(logQuery);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java#L64"><i class="icon icon-link"></i> SqlInjectionLesson8.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8.injectableQueryConfidentiality(String, String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[lines 47-141] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8.injectableQueryConfidentiality(String, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>65].</span>
<pre class="code" style="max-width: 40%;"><code>log(connection, query);<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java#L136"><i class="icon icon-link"></i> SqlInjectionLesson8.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8.log(Connection, String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[lines 47-141] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson8.log(Connection, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson8.java:[<span class='bg-dark chip'>line</span>137].</span>
<pre class="code" style="max-width: 40%;"><code>Statement statement = connection.createStatement(TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE);<br/>            statement.executeUpdate(logQuery);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java#L65"><i class="icon icon-link"></i> SqlInjectionLesson9.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson9.injectableQueryIntegrity(String, String) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson9.java:[lines 49-106] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson9 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.sql_injection.introduction.SqlInjectionLesson9.injectableQueryIntegrity(String, String) <br/><span class='bg-dark chip'>File</span>SqlInjectionLesson9.java:[<span class='bg-dark chip'>line</span>66].</span>
<pre class="code" style="max-width: 40%;"><code>SqlInjectionLesson8.log(connection, query);<br/>                ResultSet results = statement.executeQuery(query);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-918
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/ssrf/src/main/java/org/owasp/webgoat/ssrf/SSRFTask2.java#L54"><i class="icon icon-link"></i> SSRFTask2.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This web server request could be used by an attacker to expose internal services and filesystem. <br/><span class='bg-dark chip'>File</span>SSRFTask2.java:[lines 41-79] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.ssrf.SSRFTask2 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.ssrf.SSRFTask2.furBall(String) <br/><span class='bg-dark chip'>File</span>SSRFTask2.java:[<span class='bg-dark chip'>line</span>55] <br/>Sink method java/net/URL.openConnection()Ljava/net/URLConnection; <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/ssrf/SSRFTask2.furBall(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult; parameter 0 <br/>Unknown source java/net/URL.<init>(Ljava/lang/String;)V <br/>Method usage with tainted arguments detected <br/><span class='bg-dark chip'>File</span>SSRFTask2.java:[<span class='bg-dark chip'>line</span>46] <br/><span class='bg-dark chip'>File</span>SSRFTask2.java:[<span class='bg-dark chip'>line</span>54].</span>
<pre class="code" style="max-width: 40%;"><code>URL u = new URL(url);<br/>                URLConnection urlConnection = u.openConnection();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/SimpleXXE.java#L97"><i class="icon icon-link"></i> SimpleXXE.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>SimpleXXE.java:[lines 49-98] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.xxe.SimpleXXE <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.xxe.SimpleXXE.getSampleDTDFile() <br/><span class='bg-dark chip'>File</span>SimpleXXE.java:[<span class='bg-dark chip'>line</span>98].</span>
<pre class="code" style="max-width: 40%;"><code>public String getSampleDTDFile() {<br/>        return "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/SimpleXXE.java#L91"><i class="icon icon-link"></i> SimpleXXE.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>SimpleXXE.java:[lines 49-98] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.xxe.SimpleXXE <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.xxe.SimpleXXE.getWebGoatHomeDirectory() <br/><span class='bg-dark chip'>File</span>SimpleXXE.java:[<span class='bg-dark chip'>line</span>92].</span>
<pre class="code" style="max-width: 40%;"><code>public String getWebGoatHomeDirectory() {<br/>        return webGoatHomeDirectory;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/FileServer.java#L64"><i class="icon icon-link"></i> FileServer.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>FileServer.java:[lines 53-113] <br/><span class='bg-dark chip'>Class</span> org.owasp.webwolf.FileServer <br/><span class='bg-dark chip'>Method</span> org.owasp.webwolf.FileServer.getFileLocation() <br/><span class='bg-dark chip'>File</span>FileServer.java:[<span class='bg-dark chip'>line</span>65].</span>
<pre class="code" style="max-width: 40%;"><code>public String getFileLocation() {<br/>        return fileLocation;<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/WebSecurityConfig.java#L55"><i class="icon icon-link"></i> WebSecurityConfig.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Disabling Spring Security's CSRF protection is unsafe for standard web applications <br/><span class='bg-dark chip'>File</span>WebSecurityConfig.java:[lines 47-87] <br/><span class='bg-dark chip'>Class</span> org.owasp.webwolf.WebSecurityConfig <br/><span class='bg-dark chip'>Method</span> org.owasp.webwolf.WebSecurityConfig.configure(HttpSecurity) <br/><span class='bg-dark chip'>File</span>WebSecurityConfig.java:[<span class='bg-dark chip'>line</span>56].</span>
<pre class="code" style="max-width: 40%;"><code>.anyRequest().permitAll();<br/>        security.and().csrf().disable().formLogin()<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-1" class="filter-item">
            <td>CWE-352
            </td>
            <td><span class="chip bg-error">CRITICAL</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/requests/LandingPage.java#L41"><i class="icon icon-link"></i> LandingPage.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks <br/><span class='bg-dark chip'>File</span>LandingPage.java:[<span class='bg-dark chip'>line</span>42] <br/><span class='bg-dark chip'>Class</span> org.owasp.webwolf.requests.LandingPage <br/><span class='bg-dark chip'>Method</span> org.owasp.webwolf.requests.LandingPage.ok(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>LandingPage.java:[<span class='bg-dark chip'>line</span>42].</span>
<pre class="code" style="max-width: 40%;"><code>return () -> {<br/>            log.trace("Incoming request for: {}", request.getRequestURL());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-78
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/insecure-deserialization/src/main/java/org/dummy/insecure/framework/VulnerableTaskHolder.java#L55"><i class="icon icon-link"></i> VulnerableTaskHolder.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This usage of java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[lines 19-68] <br/><span class='bg-dark chip'>Class</span> org.dummy.insecure.framework.VulnerableTaskHolder <br/><span class='bg-dark chip'>Method</span> org.dummy.insecure.framework.VulnerableTaskHolder.readObject(ObjectInputStream) <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[<span class='bg-dark chip'>line</span>56] <br/>Sink method java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process; <br/>Sink parameter 0 <br/>Unknown source org/dummy/insecure/framework/VulnerableTaskHolder.taskAction <br/><span class='bg-dark chip'>File</span>VulnerableTaskHolder.java:[<span class='bg-dark chip'>line</span>56].</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            Process p = Runtime.getRuntime().exec(taskAction);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-79
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/AjaxAuthenticationEntryPoint.java#L52"><i class="icon icon-link"></i> AjaxAuthenticationEntryPoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of javax/servlet/http/HttpServletResponse.sendError(ILjava/lang/String;)V could be vulnerable to XSS in the Servlet <br/><span class='bg-dark chip'>File</span>AjaxAuthenticationEntryPoint.java:[lines 48-57] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.AjaxAuthenticationEntryPoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.AjaxAuthenticationEntryPoint.commence(HttpServletRequest, HttpServletResponse, AuthenticationException) <br/><span class='bg-dark chip'>File</span>AjaxAuthenticationEntryPoint.java:[<span class='bg-dark chip'>line</span>53] <br/>Sink method javax/servlet/http/HttpServletResponse.sendError(ILjava/lang/String;)V <br/>Sink parameter 0 <br/>Unknown source org/springframework/security/core/AuthenticationException.getMessage()Ljava/lang/String;.</span>
<pre class="code" style="max-width: 40%;"><code>if (request.getHeader("x-requested-with") != null) {<br/>            response.sendError(401, authException.getMessage());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/CryptoTest.java#L71"><i class="icon icon-link"></i> CryptoTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>CryptoTest.java:[lines 22-132] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.CryptoTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.CryptoTest.checkAssignment3() <br/><span class='bg-dark chip'>File</span>CryptoTest.java:[<span class='bg-dark chip'>line</span>72] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>params.clear();<br/>		params.put("answer_pwd1", answer_1);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-319
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/IntegrationTest.java#L70"><i class="icon icon-link"></i> IntegrationTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unencrypted socket to org.owasp.webgoat.IntegrationTest (instead of SSLSocket) <br/><span class='bg-dark chip'>File</span>IntegrationTest.java:[lines 21-297] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.IntegrationTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.IntegrationTest.isAlreadyRunning(int) <br/><span class='bg-dark chip'>File</span>IntegrationTest.java:[<span class='bg-dark chip'>line</span>71] <br/>Value 127.0.0.1.</span>
<pre class="code" style="max-width: 40%;"><code>private static boolean isAlreadyRunning(int port) {<br/>        try (var ignored = new Socket("127.0.0.1", port)) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java#L16"><i class="icon icon-link"></i> SqlInjectionAdvancedTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[lines 8-48] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.SqlInjectionAdvancedTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.SqlInjectionAdvancedTest.runTests() <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[<span class='bg-dark chip'>line</span>17] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>params.put("username_reg", "tom' AND substring(password,1,1)='t");<br/>        params.put("password_reg", "password");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java#L18"><i class="icon icon-link"></i> SqlInjectionAdvancedTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[lines 8-48] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.SqlInjectionAdvancedTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.SqlInjectionAdvancedTest.runTests() <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[<span class='bg-dark chip'>line</span>19] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>params.put("email_reg", "someone@microsoft.com");<br/>        params.put("confirm_password", "password");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java#L23"><i class="icon icon-link"></i> SqlInjectionAdvancedTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[lines 8-48] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.SqlInjectionAdvancedTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.SqlInjectionAdvancedTest.runTests() <br/><span class='bg-dark chip'>File</span>SqlInjectionAdvancedTest.java:[<span class='bg-dark chip'>line</span>24] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>params.put("username_login", "tom");<br/>        params.put("password_login", "thisisasecretfortomonly");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java#L49"><i class="icon icon-link"></i> WebGoat.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>WebGoat.java:[lines 46-67] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.WebGoat <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.WebGoat.pluginTargetDirectory(String) <br/><span class='bg-dark chip'>File</span>WebGoat.java:[<span class='bg-dark chip'>line</span>50] <br/>Sink method java/io/File.<init>(Ljava/lang/String;)V <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/WebGoat.pluginTargetDirectory(Ljava/lang/String;)Ljava/io/File; parameter 0 <br/>Method usage not detected.</span>
<pre class="code" style="max-width: 40%;"><code>public File pluginTargetDirectory(@Value("${webgoat.user.directory}") final String webgoatHome) {<br/>        return new File(webgoatHome);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge7/PasswordResetLink.java#L13"><i class="icon icon-link"></i> PasswordResetLink.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>PasswordResetLink.java:[lines 11-42] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.challenges.challenge7.PasswordResetLink <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.challenges.challenge7.PasswordResetLink.createPasswordReset(String, String) <br/><span class='bg-dark chip'>File</span>PasswordResetLink.java:[<span class='bg-dark chip'>line</span>14] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>public String createPasswordReset(String username, String key) {<br/>        Random random = new Random();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L58"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>Salaries.java:[lines 51-105] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.client_side_filtering.Salaries <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.client_side_filtering.Salaries.copyFiles() <br/><span class='bg-dark chip'>File</span>Salaries.java:[<span class='bg-dark chip'>line</span>59] <br/>Sink method java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V <br/>Sink parameter 1 <br/>Unknown source org/owasp/webgoat/client_side_filtering/Salaries.webGoatHomeDirectory <br/><span class='bg-dark chip'>File</span>Salaries.java:[<span class='bg-dark chip'>line</span>59].</span>
<pre class="code" style="max-width: 40%;"><code>ClassPathResource classPathResource = new ClassPathResource("employees.xml");<br/>        File targetDirectory = new File(webGoatHomeDirectory, "/ClientSideFiltering");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java#L73"><i class="icon icon-link"></i> Salaries.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>Salaries.java:[lines 51-105] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.client_side_filtering.Salaries <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.client_side_filtering.Salaries.invoke() <br/><span class='bg-dark chip'>File</span>Salaries.java:[<span class='bg-dark chip'>line</span>74] <br/>Sink method java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V <br/>Sink parameter 1 <br/>Unknown source org/owasp/webgoat/client_side_filtering/Salaries.webGoatHomeDirectory <br/><span class='bg-dark chip'>File</span>Salaries.java:[<span class='bg-dark chip'>line</span>74].</span>
<pre class="code" style="max-width: 40%;"><code>NodeList nodes = null;<br/>        File d = new File(webGoatHomeDirectory, "ClientSideFiltering/employees.xml");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/EncodingAssignment.java#L52"><i class="icon icon-link"></i> EncodingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>EncodingAssignment.java:[lines 40-71] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.EncodingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.EncodingAssignment.getBasicAuth(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>EncodingAssignment.java:[<span class='bg-dark chip'>line</span>53] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>if (basicAuth == null) {<br/>			String password = HashingAssignment.SECRETS[new Random().nextInt(HashingAssignment.SECRETS.length)];<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L54"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.getMd5(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>55] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code><br/>			String secret = SECRETS[new Random().nextInt(SECRETS.length)];<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L73"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.getSha256(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>74] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>if (sha256 == null) {<br/>			String secret = SECRETS[new Random().nextInt(SECRETS.length)];<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-203
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L89"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unsafe comparison of hash that are susceptible to timing attack <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.completed(HttpServletRequest, String, String) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>90] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0 <br/>Unknown source javax/servlet/http/HttpSession.getAttribute(Ljava/lang/String;)Ljava/lang/Object;.</span>
<pre class="code" style="max-width: 40%;"><code>if (answer_pwd1!=null && answer_pwd2 !=null) {<br/>        	if (answer_pwd1.equals(md5Secret)<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-203
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L90"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unsafe comparison of hash that are susceptible to timing attack <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.completed(HttpServletRequest, String, String) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>91] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0 <br/>Unknown source javax/servlet/http/HttpSession.getAttribute(Ljava/lang/String;)Ljava/lang/Object;.</span>
<pre class="code" style="max-width: 40%;"><code>if (answer_pwd1.equals(md5Secret)<br/>        		&& answer_pwd2.equals(sha256Secret)) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-203
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L94"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unsafe comparison of hash that are susceptible to timing attack <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.completed(HttpServletRequest, String, String) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>95] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0 <br/>Unknown source javax/servlet/http/HttpSession.getAttribute(Ljava/lang/String;)Ljava/lang/Object;.</span>
<pre class="code" style="max-width: 40%;"><code>.build();<br/>        	} else if (answer_pwd1.equals(md5Secret)<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-203
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java#L95"><i class="icon icon-link"></i> HashingAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unsafe comparison of hash that are susceptible to timing attack <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[lines 44-108] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.crypto.HashingAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.crypto.HashingAssignment.completed(HttpServletRequest, String, String) <br/><span class='bg-dark chip'>File</span>HashingAssignment.java:[<span class='bg-dark chip'>line</span>96] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0 <br/>Unknown source javax/servlet/http/HttpSession.getAttribute(Ljava/lang/String;)Ljava/lang/Object;.</span>
<pre class="code" style="max-width: 40%;"><code>} else if (answer_pwd1.equals(md5Secret)<br/>            		|| answer_pwd2.equals(sha256Secret)) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/csrf/CSRFGetFlag.java#L61"><i class="icon icon-link"></i> CSRFGetFlag.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[lines 42-86] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.csrf.CSRFGetFlag <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.csrf.CSRFGetFlag.invoke(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[<span class='bg-dark chip'>line</span>62] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>if ("true".equals(req.getParameter("csrf"))) {<br/>                Random random = new Random();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/csrf/CSRFGetFlag.java#L67"><i class="icon icon-link"></i> CSRFGetFlag.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[lines 42-86] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.csrf.CSRFGetFlag <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.csrf.CSRFGetFlag.invoke(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[<span class='bg-dark chip'>line</span>68] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>} else {<br/>                Random random = new Random();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/csrf/src/main/java/org/owasp/webgoat/csrf/CSRFGetFlag.java#L78"><i class="icon icon-link"></i> CSRFGetFlag.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[lines 42-86] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.csrf.CSRFGetFlag <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.csrf.CSRFGetFlag.invoke(HttpServletRequest) <br/><span class='bg-dark chip'>File</span>CSRFGetFlag.java:[<span class='bg-dark chip'>line</span>79] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>} else {<br/>            Random random = new Random();<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/idor/src/main/java/org/owasp/webgoat/idor/IDORLogin.java#L43"><i class="icon icon-link"></i> IDORLogin.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>IDORLogin.java:[lines 37-72] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.idor.IDORLogin <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.idor.IDORLogin.initIDORInfo() <br/><span class='bg-dark chip'>File</span>IDORLogin.java:[<span class='bg-dark chip'>line</span>44] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>idorUserInfo.put("tom", new HashMap<String, String>());<br/>        idorUserInfo.get("tom").put("password", "cat");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/idor/src/main/java/org/owasp/webgoat/idor/IDORLogin.java#L49"><i class="icon icon-link"></i> IDORLogin.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>IDORLogin.java:[lines 37-72] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.idor.IDORLogin <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.idor.IDORLogin.initIDORInfo() <br/><span class='bg-dark chip'>File</span>IDORLogin.java:[<span class='bg-dark chip'>line</span>50] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>idorUserInfo.put("bill", new HashMap<String, String>());<br/>        idorUserInfo.get("bill").put("password", "buffalo");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java#L93"><i class="icon icon-link"></i> JWTFinalEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC) <br/><span class='bg-dark chip'>File</span>JWTFinalEndpoint.java:[lines 89-101] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTFinalEndpoint$1 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTFinalEndpoint$1.resolveSigningKeyBytes(JwsHeader, Claims) <br/><span class='bg-dark chip'>File</span>JWTFinalEndpoint.java:[<span class='bg-dark chip'>line</span>94] <br/>Sink method java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; <br/>Sink parameter 0 <br/>Unknown source io/jsonwebtoken/JwsHeader.get(Ljava/lang/Object;)Ljava/lang/Object; <br/><span class='bg-dark chip'>File</span>JWTFinalEndpoint.java:[<span class='bg-dark chip'>line</span>94].</span>
<pre class="code" style="max-width: 40%;"><code>try (var connection = dataSource.getConnection()) {<br/>                            ResultSet rs = connection.createStatement().executeQuery("SELECT key FROM jwt_keys WHERE id = '" + kid + "'");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-89
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java#L93"><i class="icon icon-link"></i> JWTFinalEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">org.owasp.webgoat.jwt.JWTFinalEndpoint$1.resolveSigningKeyBytes(JwsHeader, Claims) passes a nonconstant String to an execute or addBatch method on an SQL statement <br/><span class='bg-dark chip'>File</span>JWTFinalEndpoint.java:[lines 89-101] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTFinalEndpoint$1 <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTFinalEndpoint$1.resolveSigningKeyBytes(JwsHeader, Claims) <br/><span class='bg-dark chip'>File</span>JWTFinalEndpoint.java:[<span class='bg-dark chip'>line</span>94].</span>
<pre class="code" style="max-width: 40%;"><code>try (var connection = dataSource.getConnection()) {<br/>                            ResultSet rs = connection.createStatement().executeQuery("SELECT key FROM jwt_keys WHERE id = '" + kid + "'");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTRefreshEndpointTest.java#L158"><i class="icon icon-link"></i> JWTRefreshEndpointTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>JWTRefreshEndpointTest.java:[lines 48-215] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTRefreshEndpointTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTRefreshEndpointTest.newTokenShouldWorkForJerry() <br/><span class='bg-dark chip'>File</span>JWTRefreshEndpointTest.java:[<span class='bg-dark chip'>line</span>159] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>loginJson.put("user", "Jerry");<br/>        loginJson.put("password", PASSWORD);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTRefreshEndpointTest.java#L181"><i class="icon icon-link"></i> JWTRefreshEndpointTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>JWTRefreshEndpointTest.java:[lines 48-215] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTRefreshEndpointTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTRefreshEndpointTest.unknownRefreshTokenShouldGiveUnauthorized() <br/><span class='bg-dark chip'>File</span>JWTRefreshEndpointTest.java:[<span class='bg-dark chip'>line</span>182] <br/>Sink method java/util/Map.put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>loginJson.put("user", "Jerry");<br/>        loginJson.put("password", PASSWORD);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-330
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpoint.java#L50"><i class="icon icon-link"></i> JWTSecretKeyEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This random generator (java.util.Random) is predictable <br/><span class='bg-dark chip'>File</span>JWTSecretKeyEndpoint.java:[lines 48-89] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTSecretKeyEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTSecretKeyEndpoint.<static initializer for JWTSecretKeyEndpoint>() <br/><span class='bg-dark chip'>File</span>JWTSecretKeyEndpoint.java:[<span class='bg-dark chip'>line</span>51] <br/>Value java.util.Random.</span>
<pre class="code" style="max-width: 40%;"><code>public static final String[] SECRETS = {"victory", "business", "available", "shipping", "washington"};<br/>    public static final String JWT_SECRET = TextCodec.BASE64.encode(SECRETS[new Random().nextInt(SECRETS.length)]);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>HTTPONLY_COOKIE
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java#L97"><i class="icon icon-link"></i> JWTVotesEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Cookie without the HttpOnly flag could be read by a malicious script in the browser <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[lines 61-173] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTVotesEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTVotesEndpoint.login(String, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[<span class='bg-dark chip'>line</span>98].</span>
<pre class="code" style="max-width: 40%;"><code>.compact();<br/>            Cookie cookie = new Cookie("access_token", token);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>HTTPONLY_COOKIE
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java#L102"><i class="icon icon-link"></i> JWTVotesEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Cookie without the HttpOnly flag could be read by a malicious script in the browser <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[lines 61-173] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTVotesEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTVotesEndpoint.login(String, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[<span class='bg-dark chip'>line</span>103].</span>
<pre class="code" style="max-width: 40%;"><code>} else {<br/>            Cookie cookie = new Cookie("access_token", "");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-614
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java#L97"><i class="icon icon-link"></i> JWTVotesEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Cookie without the secure flag could be sent in clear text if a HTTP URL is visited <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[lines 61-173] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTVotesEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTVotesEndpoint.login(String, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[<span class='bg-dark chip'>line</span>98].</span>
<pre class="code" style="max-width: 40%;"><code>.compact();<br/>            Cookie cookie = new Cookie("access_token", token);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-614
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java#L102"><i class="icon icon-link"></i> JWTVotesEndpoint.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Cookie without the secure flag could be sent in clear text if a HTTP URL is visited <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[lines 61-173] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.jwt.JWTVotesEndpoint <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.jwt.JWTVotesEndpoint.login(String, HttpServletResponse) <br/><span class='bg-dark chip'>File</span>JWTVotesEndpoint.java:[<span class='bg-dark chip'>line</span>103].</span>
<pre class="code" style="max-width: 40%;"><code>} else {<br/>            Cookie cookie = new Cookie("access_token", "");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-212
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java#L83"><i class="icon icon-link"></i> MissingFunctionACUsers.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unexpected property could be leaked because a persistence class is directly exposed to the client <br/><span class='bg-dark chip'>File</span>MissingFunctionACUsers.java:[lines 44-93] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.missing_ac.MissingFunctionACUsers <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.missing_ac.MissingFunctionACUsers.addUser(WebGoatUser) <br/><span class='bg-dark chip'>File</span>MissingFunctionACUsers.java:[lines 84-93].</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            userService.addUser(newUser.getUsername(),newUser.getPassword(),newUser.getRole());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-915
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java#L83"><i class="icon icon-link"></i> MissingFunctionACUsers.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">The persistent objects could be exploited by attacker to read sensitive information. <br/><span class='bg-dark chip'>File</span>MissingFunctionACUsers.java:[lines 44-93] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.missing_ac.MissingFunctionACUsers <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.missing_ac.MissingFunctionACUsers.addUser(WebGoatUser) <br/><span class='bg-dark chip'>File</span>MissingFunctionACUsers.java:[lines 84-93].</span>
<pre class="code" style="max-width: 40%;"><code>try {<br/>            userService.addUser(newUser.getUsername(),newUser.getPassword(),newUser.getRole());<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-203
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACYourHash.java#L49"><i class="icon icon-link"></i> MissingFunctionACYourHash.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Unsafe comparison of hash that are susceptible to timing attack <br/><span class='bg-dark chip'>File</span>MissingFunctionACYourHash.java:[lines 39-53] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.missing_ac.MissingFunctionACYourHash <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.missing_ac.MissingFunctionACYourHash.completed(String) <br/><span class='bg-dark chip'>File</span>MissingFunctionACYourHash.java:[<span class='bg-dark chip'>line</span>50] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0 <br/>Unknown source org/owasp/webgoat/missing_ac/DisplayUser.getUserHash()Ljava/lang/String; <br/>Unknown source org/owasp/webgoat/missing_ac/DisplayUser.userHash <br/><span class='bg-dark chip'>File</span>DisplayUser.java:[<span class='bg-dark chip'>line</span>82] <br/><span class='bg-dark chip'>File</span>MissingFunctionACYourHash.java:[<span class='bg-dark chip'>line</span>50].</span>
<pre class="code" style="max-width: 40%;"><code>DisplayUser displayUser = new DisplayUser(user);<br/>        if (userHash.equals(displayUser.getUserHash())) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-259
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/password_reset/ResetLinkAssignment.java#L68"><i class="icon icon-link"></i> ResetLinkAssignment.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">Hard coded password found <br/><span class='bg-dark chip'>File</span>ResetLinkAssignment.java:[lines 46-123] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.password_reset.ResetLinkAssignment <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.password_reset.ResetLinkAssignment.login(String, String) <br/><span class='bg-dark chip'>File</span>ResetLinkAssignment.java:[<span class='bg-dark chip'>line</span>69] <br/>Sink method java/lang/String.equals(Ljava/lang/Object;)Z <br/>Sink parameter 0.</span>
<pre class="code" style="max-width: 40%;"><code>String passwordTom = usersToTomPassword.getOrDefault(getWebSession().getUserName(), PASSWORD_TOM_9);<br/>            if (passwordTom.equals(PASSWORD_TOM_9)) {<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/xxe/src/test/java/org/owasp/webgoat/xxe/BlindSendFileAssignmentTest.java#L78"><i class="icon icon-link"></i> BlindSendFileAssignmentTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[lines 35-142] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.xxe.BlindSendFileAssignmentTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.xxe.BlindSendFileAssignmentTest.solve() <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[<span class='bg-dark chip'>line</span>79] <br/>Sink method java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V <br/>Sink parameter 1 <br/>Unknown source org/owasp/webgoat/xxe/BlindSendFileAssignmentTest.webGoatHomeDirectory <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[<span class='bg-dark chip'>line</span>79].</span>
<pre class="code" style="max-width: 40%;"><code>public void solve() throws Exception {<br/>        File targetFile = new File(webGoatHomeDirectory, "/XXE/secret.txt");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webgoat-lessons/xxe/src/test/java/org/owasp/webgoat/xxe/BlindSendFileAssignmentTest.java#L102"><i class="icon icon-link"></i> BlindSendFileAssignmentTest.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[lines 35-142] <br/><span class='bg-dark chip'>Class</span> org.owasp.webgoat.xxe.BlindSendFileAssignmentTest <br/><span class='bg-dark chip'>Method</span> org.owasp.webgoat.xxe.BlindSendFileAssignmentTest.solveOnlyParamReferenceEntityInExternalDTD() <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[<span class='bg-dark chip'>line</span>103] <br/>Sink method java/io/File.<init>(Ljava/lang/String;Ljava/lang/String;)V <br/>Sink parameter 1 <br/>Unknown source org/owasp/webgoat/xxe/BlindSendFileAssignmentTest.webGoatHomeDirectory <br/><span class='bg-dark chip'>File</span>BlindSendFileAssignmentTest.java:[<span class='bg-dark chip'>line</span>103].</span>
<pre class="code" style="max-width: 40%;"><code>public void solveOnlyParamReferenceEntityInExternalDTD() throws Exception {<br/>        File targetFile = new File(webGoatHomeDirectory, "/XXE/secret.txt");<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-22
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/MvcConfiguration.java#L61"><i class="icon icon-link"></i> MvcConfiguration.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input <br/><span class='bg-dark chip'>File</span>MvcConfiguration.java:[lines 44-66] <br/><span class='bg-dark chip'>Class</span> org.owasp.webwolf.MvcConfiguration <br/><span class='bg-dark chip'>Method</span> org.owasp.webwolf.MvcConfiguration.createDirectory() <br/><span class='bg-dark chip'>File</span>MvcConfiguration.java:[<span class='bg-dark chip'>line</span>62] <br/>Sink method java/io/File.<init>(Ljava/lang/String;)V <br/>Sink parameter 0 <br/>Unknown source org/owasp/webwolf/MvcConfiguration.fileLocatation <br/><span class='bg-dark chip'>File</span>MvcConfiguration.java:[<span class='bg-dark chip'>line</span>62].</span>
<pre class="code" style="max-width: 40%;"><code>public void createDirectory() {<br/>        File file = new File(fileLocatation);<br/>
</code>
</pre>
            </td>
          </tr>



          <tr data-tag="tag-2" class="filter-item">
            <td>CWE-915
            </td>
            <td><span class="chip bg-warning">HIGH</span></td>
            <td><a target="_blank" class="btn btn-link" href="file:///Users/guest/work/WebGoat/webwolf/src/main/java/org/owasp/webwolf/mailbox/MailboxController.java#L64"><i class="icon icon-link"></i> MailboxController.java</a></td>
            <td>
              <span style="max-width: 40%;" class="d-inline-block">The persistent objects could be exploited by attacker to read sensitive information. <br/><span class='bg-dark chip'>File</span>MailboxController.java:[lines 48-67] <br/><span class='bg-dark chip'>Class</span> org.owasp.webwolf.mailbox.MailboxController <br/><span class='bg-dark chip'>Method</span> org.owasp.webwolf.mailbox.MailboxController.sendEmail(Email) <br/><span class='bg-dark chip'>File</span>MailboxController.java:[<span class='bg-dark chip'>line</span>65].</span>
<pre class="code" style="max-width: 40%;"><code>public Callable<ResponseEntity<?>> sendEmail(@RequestBody Email email) {<br/>        return () -> {<br/>
</code>
</pre>
            </td>
          </tr>
        </tbody>
      </table>
        </div>
      </div>
    </div>
  </div>
</div>
<div class="container grid-xl" style="height: 2rem; color: #bcc3ce;">
  <p>Thank you for supporting <a href="https://www.shiftleft.io" target="_blank">ShiftLeft</a></p>
</div>
</body>
</html>
